Improper Control of Generation of Code in Twig Rendered Views in Shopware

Vulnerability

Overview CVE-2023-2017 is a server-side template injection (SSTI) vulnerability in Shopware 6 affecting versions up to 6.4.20.0 and 6.5.0.0-rc1 through 6.5.0.0-rc4. It bypasses the previous fix for CVE-2023-22731 [1]. The root cause is an incomplete validation in Shopware\Core\Framework\Adapter\Twig\SecurityExtension, which fails to properly restrict fully-qualified names supplied as arrays of strings when referencing callables [2].

Exploitation

An attacker with access to a Twig environment without the Sandbox extension (e.g., admin panel access) can craft a malicious template using fully-qualified PHP class names. By supplying callables as arrays, the attacker bypasses the security checks and invokes arbitrary PHP functions [1][2]. The attack requires low privileges (e.g., admin login) and no user interaction [2].

Impact

Successful exploitation allows the attacker to call any PHP function, leading to complete compromise of the server, including data theft, modification, or denial of service. The CVSS score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H [2].

Mitigation

Shopware has released version 6.4.20.1, which fixes the vulnerability [4]. Users are strongly advised to upgrade immediately. There is no workaround available [1].